@go-to-k/cdkd 0.268.3 → 0.268.5

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-DEi5-8x-.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-IGjv53i5.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-bxS6B6Ja.js";
+import { t as ASGProvider } from "./asg-provider-Beq_IUQH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -404,6 +404,28 @@ function validateWaitFlags(opts) {
 	if (opts.wait === false && opts.fullWait === true) throw new Error("--no-wait and --full-wait cannot be combined: --no-wait skips stabilization waits, --full-wait adds them. Pick one.");
 }
 /**
+* Validate the wait-flag pair and project it onto the process env the
+* providers read. One helper instead of three separate lines in deploy.ts
+* so the validation, the two mode envs, and the availability marker cannot
+* drift apart individually (issue #1291 item 6 — the wiring had no unit
+* coverage because it lived inline in the deploy command's action).
+*
+* - `CDKD_NO_WAIT` — set when `--no-wait` was passed; providers skip
+*   convenience stabilization waits.
+* - `CDKD_FULL_WAIT` — set when `--full-wait` was passed; providers add
+*   the CloudFormation-side waits cdkd skips by default.
+* - `CDKD_WAIT_FLAGS_AVAILABLE` — set unconditionally by commands that
+*   DECLARE the wait flags (today: deploy). Providers gate flag-mentioning
+*   hints on it, so `cdkd drift --revert` reaching the same provider code
+*   never advertises a flag drift does not accept (issue #1291 item 1).
+*/
+function applyWaitFlagEnv(opts) {
+	validateWaitFlags(opts);
+	process.env["CDKD_WAIT_FLAGS_AVAILABLE"] = "true";
+	if (opts.wait === false) process.env["CDKD_NO_WAIT"] = "true";
+	if (opts.fullWait === true) process.env["CDKD_FULL_WAIT"] = "true";
+}
+/**
 * Drop the CDK-injected defensive `DependsOn` edges from VPC Lambdas (and
 * adjacent IAM Role / Policy / Lambda::Url / EventSourceMapping resources)
 * onto the private subnet's `DefaultRoute` / `RouteTableAssociation`. CDK
@@ -8446,7 +8468,9 @@ var LambdaFunctionProvider = class {
 		try {
 			await waitUntilFunctionUpdatedV2({
 				client: this.lambdaClient,
-				maxWaitTime: this.functionUpdateMaxWaitSeconds
+				maxWaitTime: this.functionUpdateMaxWaitSeconds,
+				minDelay: 1,
+				maxDelay: 5
 			}, { FunctionName: functionName });
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -14821,6 +14845,7 @@ var EC2Provider = class {
 			"BlockDeviceMappings",
 			"Tags",
 			"AvailabilityZone",
+			"NetworkInterfaces",
 			"DisableApiTermination",
 			"MetadataOptions",
 			"Monitoring",
@@ -15893,10 +15918,12 @@ var EC2Provider = class {
 			const securityGroupIds = properties["SecurityGroupIds"];
 			const securityGroups = properties["SecurityGroups"];
 			const iamInstanceProfile = this.normalizeIamInstanceProfile(properties["IamInstanceProfile"]);
+			const networkInterfaces = this.buildNetworkInterfaces(properties);
 			const instance = (await this.ec2Client.send(new RunInstancesCommand({
 				ImageId: imageId,
 				InstanceType: instanceType,
 				KeyName: properties["KeyName"] ?? void 0,
+				NetworkInterfaces: networkInterfaces,
 				SecurityGroupIds: securityGroupIds ?? void 0,
 				SecurityGroups: securityGroups ?? void 0,
 				SubnetId: properties["SubnetId"] ?? void 0,
@@ -16293,6 +16320,48 @@ var EC2Provider = class {
 		return { AvailabilityZone: az };
 	}
 	/**
+	* Map the CFn `AWS::EC2::Instance.NetworkInterfaces` list onto
+	* RunInstances' `NetworkInterfaces` input (issue #1281). Every CFn
+	* sub-field is mapped (dropping a sub-field silently would be the #1225
+	* bug class one level down): the two casing/shape divergences are
+	* `GroupSet` -> `Groups` and CFn's stringly-typed numerics
+	* (`DeviceIndex`, `Ipv6AddressCount`, `SecondaryPrivateIpAddressCount`
+	* arrive as strings from CDK) -> numbers.
+	*/
+	buildNetworkInterfaces(properties) {
+		const raw = properties["NetworkInterfaces"];
+		if (!Array.isArray(raw) || raw.length === 0) return void 0;
+		return raw.map((entry) => {
+			const ni = entry ?? {};
+			return {
+				DeviceIndex: this.coerceNumber(ni["DeviceIndex"]),
+				SubnetId: ni["SubnetId"] ?? void 0,
+				Groups: ni["GroupSet"] ?? void 0,
+				AssociatePublicIpAddress: this.coerceBool(ni["AssociatePublicIpAddress"]),
+				AssociateCarrierIpAddress: this.coerceBool(ni["AssociateCarrierIpAddress"]),
+				DeleteOnTermination: this.coerceBool(ni["DeleteOnTermination"]),
+				Description: ni["Description"] ?? void 0,
+				NetworkInterfaceId: ni["NetworkInterfaceId"] ?? void 0,
+				PrivateIpAddress: ni["PrivateIpAddress"] ?? void 0,
+				Ipv6AddressCount: this.coerceNumber(ni["Ipv6AddressCount"]),
+				Ipv6Addresses: Array.isArray(ni["Ipv6Addresses"]) ? ni["Ipv6Addresses"].map((a) => ({ Ipv6Address: a?.["Ipv6Address"] ?? void 0 })) : void 0,
+				PrivateIpAddresses: Array.isArray(ni["PrivateIpAddresses"]) ? ni["PrivateIpAddresses"].map((a) => ({
+					Primary: this.coerceBool(a?.["Primary"]),
+					PrivateIpAddress: a?.["PrivateIpAddress"] ?? void 0
+				})) : void 0,
+				SecondaryPrivateIpAddressCount: this.coerceNumber(ni["SecondaryPrivateIpAddressCount"])
+			};
+		});
+	}
+	/**
+	* CFn numerics are stringly typed on the wire ("0", not 0); RunInstances
+	* wants numbers. Tolerate both, return undefined for anything else.
+	*/
+	coerceNumber(value) {
+		if (typeof value === "number" && Number.isFinite(value)) return value;
+		if (typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value))) return Number(value);
+	}
+	/**
 	* Build the RunInstances `CreditSpecification` shape from the CFn
 	* `CreditSpecification` object. CFn uses `CPUCredits` (capital CPU, the
 	* canonical CDK `CfnInstance` emission); accept the SDK-style `CpuCredits`
@@ -16870,6 +16939,7 @@ var EC2Provider = class {
 	*/
 	getDriftUnknownPaths(resourceType) {
 		switch (resourceType) {
+			case "AWS::EC2::Instance": return ["NetworkInterfaces"];
 			case "AWS::EC2::Route":
 			case "AWS::EC2::VPCGatewayAttachment":
 			case "AWS::EC2::SubnetRouteTableAssociation":
@@ -16979,6 +17049,15 @@ var EC2Provider = class {
 		}
 		if (instance.Placement?.Tenancy !== void 0) result["Tenancy"] = instance.Placement.Tenancy;
 		if (instance.IamInstanceProfile?.Arn !== void 0) result["IamInstanceProfile"] = instance.IamInstanceProfile.Arn;
+		else if (process.env["CDKD_NO_WAIT"] === "true" && instance.State?.Name === "pending") try {
+			const live = (await this.ec2Client.send(new DescribeIamInstanceProfileAssociationsCommand({ Filters: [{
+				Name: "instance-id",
+				Values: [physicalId]
+			}] }))).IamInstanceProfileAssociations?.find((a) => a.State === "associated" || a.State === "associating");
+			if (live?.IamInstanceProfile?.Arn !== void 0) result["IamInstanceProfile"] = live.IamInstanceProfile.Arn;
+		} catch (error) {
+			this.logger.warn(`Could not backfill IamInstanceProfile for ${physicalId} during the --no-wait capture (${error instanceof Error ? error.message : String(error)}); the field is omitted from the observed snapshot`);
+		}
 		const volumeIds = (instance.BlockDeviceMappings ?? []).filter((m) => m.Ebs?.VolumeId !== void 0).map((m) => m.Ebs.VolumeId);
 		let volumesById = /* @__PURE__ */ new Map();
 		if (volumeIds.length > 0) try {
@@ -22533,7 +22612,8 @@ var ECSProvider = class {
 			return;
 		}
 		const clusterArg = cluster ? ` --cluster ${cluster}` : "";
-		this.logger.info(`ECS service ${logicalId} accepted (not waiting for steady state; pass --full-wait to wait). To wait manually: aws ecs wait services-stable${clusterArg} --services ${serviceRef}`);
+		const fullWaitHint = process.env["CDKD_WAIT_FLAGS_AVAILABLE"] === "true" ? "; pass --full-wait to wait" : "";
+		this.logger.info(`ECS service ${logicalId} accepted (not waiting for steady state${fullWaitHint}). To wait manually: aws ecs wait services-stable${clusterArg} --services ${serviceRef}`);
 	}
 	async updateService(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating ECS service ${logicalId}: ${physicalId}`);
@@ -43079,13 +43159,11 @@ async function deployCommand(stacks, options) {
 	}
 	warnIfDeprecatedRegion(options);
 	validateResourceTimeouts(options);
-	validateWaitFlags(options);
+	applyWaitFlagEnv(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
 		region: options.region
 	});
-	if (!options.wait) process.env["CDKD_NO_WAIT"] = "true";
-	if (options.fullWait) process.env["CDKD_FULL_WAIT"] = "true";
 	warnDeprecatedNoPrefixCliFlag();
 	const skipPrefix = resolveSkipPrefix({ prefixUserSuppliedNames: options.prefixUserSuppliedNames });
 	if (skipPrefix) logger.debug("Skipping stack-name prefix on user-supplied physical names (default since v0.94.0)");
@@ -43944,7 +44022,9 @@ async function retireCloudFormationStack(options) {
 			}
 			if (updateRan) await waitUntilStackUpdateComplete({
 				client: cfnClient,
-				maxWaitTime: 1800
+				maxWaitTime: 1800,
+				minDelay: 5,
+				maxDelay: 10
 			}, { StackName: cfnStackName });
 		} finally {
 			const allCleanups = [...s3Cleanup ? [s3Cleanup] : [], ...nestedCleanups];
@@ -43960,7 +44040,9 @@ async function retireCloudFormationStack(options) {
 	await cfnClient.send(new DeleteStackCommand({ StackName: cfnStackName }));
 	await waitUntilStackDeleteComplete({
 		client: cfnClient,
-		maxWaitTime: 1800
+		maxWaitTime: 1800,
+		minDelay: 5,
+		maxDelay: 10
 	}, { StackName: cfnStackName });
 	logger.info(`✓ CloudFormation stack '${cfnStackName}' retired. AWS resources are now solely managed by cdkd.`);
 	return { outcome: modified ? "retired" : "no-template-change" };
@@ -48153,7 +48235,9 @@ async function submitImportChangeSet(cfnClient, stackName, template, resourcesTo
 		try {
 			await waitUntilChangeSetCreateComplete({
 				client: cfnClient,
-				maxWaitTime: 600
+				maxWaitTime: 600,
+				minDelay: 2,
+				maxDelay: 5
 			}, {
 				StackName: stackName,
 				ChangeSetName: changeSetName
@@ -48182,7 +48266,9 @@ async function submitImportChangeSet(cfnClient, stackName, template, resourcesTo
 			}));
 			await waitUntilStackImportComplete({
 				client: cfnClient,
-				maxWaitTime: 3600
+				maxWaitTime: 3600,
+				minDelay: 5,
+				maxDelay: 10
 			}, { StackName: stackName });
 		} catch (err) {
 			const failureSummary = await collectImportFailureSummary(cfnClient, stackName).catch(() => "");
@@ -48282,7 +48368,9 @@ async function flipStackToUpdateComplete(cfnClient, cfnStackName, parameters) {
 	}));
 	await waitUntilStackUpdateComplete({
 		client: cfnClient,
-		maxWaitTime: 1800
+		maxWaitTime: 1800,
+		minDelay: 5,
+		maxDelay: 10
 	}, { StackName: cfnStackName });
 }
 /**
@@ -48881,7 +48969,9 @@ async function executeUpdateChangeSet(cfnClient, stackName, template, parameters
 		try {
 			await waitUntilChangeSetCreateComplete({
 				client: cfnClient,
-				maxWaitTime: 600
+				maxWaitTime: 600,
+				minDelay: 2,
+				maxDelay: 5
 			}, {
 				StackName: stackName,
 				ChangeSetName: changeSetName
@@ -48910,7 +49000,9 @@ async function executeUpdateChangeSet(cfnClient, stackName, template, parameters
 			}));
 			await waitUntilStackUpdateComplete({
 				client: cfnClient,
-				maxWaitTime: 3600
+				maxWaitTime: 3600,
+				minDelay: 5,
+				maxDelay: 10
 			}, { StackName: stackName });
 		} catch (err) {
 			await cfnClient.send(new DeleteChangeSetCommand({
@@ -62725,7 +62817,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.268.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.268.5");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;